CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Cisco Aironet Access Point Software version 8.2(100.0) on 1830e, 1830i, 1850e, 1850i, 2800, and 3800 access points allows local users to obtain Linux root access via crafted CLI command parameters.
The libclamav library in ClamAV, used in Cisco Email Security Appliance and Web Security Appliance devices, has a vulnerability that allows remote attackers to cause a denial of service via a crafted document. This affects versions before 9.7.0-125 for ESA and before 9.0.1-135 and 9.1.1-041 for WSA.
The vulnerability in Symantec Embedded Security allows remote authenticated users to conduct argument-injection attacks by leveraging access to certain named pipes. It affects versions before 1.0 MP5, 6.5.0 before MP1, before 5.2.9 MP6, and 6.x before 6.5 MP1 and 6.6 before MP1.
A directory traversal vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection allows remote authenticated users to write update-package data to arbitrary agent locations.
CVE-2015-8798 describes a directory traversal vulnerability in the Management Server of Symantec Embedded Security products. It allows remote authenticated users to execute arbitrary code via unspecified vectors.
CVE-2015-8157 is a SQL injection vulnerability in the Management Server of Symantec Embedded Security products. It allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Virtual servers in F5 BIG-IP 11.5.4, when SSL profiles are enabled, allow remote attackers to cause a denial of service through resource consumption and Traffic Management Microkernel restart via an SSL alert during the handshake.
Apache Struts versions 2.3.19 to 2.3.28 with Dynamic Method Invocation enabled allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.
Multiple SQL injection vulnerabilities in the scoped_search function in Katello allow remote authenticated users to execute arbitrary SQL commands via the sort_by or sort_order parameter.
In nginx before 1.10.1 and 1.11.x before 1.11.1, a vulnerability allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a crafted request, involving writing a client request body to a temporary file.
Apache Shiro w wersjach przed 1.2.5, gdy klucz szyfrujący nie został skonfigurowany dla funkcji 'zapamiętaj mnie', umożliwia zdalnym atakującym wykonanie dowolnego kodu lub ominięcie zamierzonych ograniczeń dostępu poprzez nieokreślony parametr żądania.
The CInArchive::ReadFileItem method in 7zip versions 9.20 and 15.05 beta and p7zip allows remote attackers to cause a denial of service (out-of-bounds read) or execute arbitrary code via the PartitionRef field in the Long Allocation Descriptor in a UDF file.
The PDO adapters in Zend Framework before 1.12.16 do not filter null bytes in SQL statements, allowing remote attackers to execute arbitrary SQL commands via a crafted query.
Apache James Server version 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unspecified vectors.
Doctrine Annotations, Cache, Common, ORM, and MongoDB ODM have a vulnerability due to improper permissions for cache directories, allowing local users to execute arbitrary PHP code with elevated privileges.
Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to read and write to arbitrary memory locations on the host via guest QXL commands related to surface creation.
Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to cause a denial of service or possibly execute arbitrary code on the host via QXL commands related to the surface_id parameter.
The service daemon in CRIU creates log and dump files insecurely, allowing local users to create arbitrary files and take ownership of existing files via unspecified vectors related to a directory path.
The t42_parse_encoding function in FreeType before version 2.5.4 does not properly update the current position for immediates-only mode, allowing remote attackers to cause a denial of service (infinite loop) via a Type42 font.
In FreeType versions before 2.5.4, functions responsible for parsing font matrices do not check return values, which can lead to uninitialized memory access and application crashes.